PT-2026-41868
CVE-2026-8827
·
Published
2026-05-19
·
Updated
2026-05-19
Description by
CVSS 4.0
8.2
HighMetricsAV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
Address List (tt address) (affected versions not specified)
Description
The
AddressRepository::getSqlQuery() function constructs a database query without properly sanitizing user input, which can lead to SQL Injection (a technique where malicious SQL statements are inserted into entry fields for execution). While this method is not called within the extension by default, custom extensions that invoke it using untrusted input can expose the site to this risk.Recommendations
As a temporary workaround, avoid calling the
getSqlQuery() function with untrusted input in custom extensions.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploitability
Exploit
Impacts
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾